Login Sign Up

CVE-2023-39417

7.5 HIGH
SQL Injection

📋 TL;DR

This SQL injection vulnerability in PostgreSQL allows attackers with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser when exploiting improperly quoted extension script variables. It affects PostgreSQL installations with vulnerable non-bundled extensions installed by administrators. The vulnerability requires both a vulnerable extension and attacker database privileges.

💻 Affected Systems

Products:
  • PostgreSQL
Versions: All versions before security updates (specific versions in Red Hat advisories)
Operating Systems: All operating systems running PostgreSQL
Default Config Vulnerable: ✅ No
Notes: Requires: 1) Non-bundled extension with vulnerable script using @extowner@, @extschema@, or @extschema:...@ inside quoting constructs, 2) Extension installed by administrator, 3) Attacker with database-level CREATE privilege.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Enterprise Linux by Redhat

View all CVEs affecting Enterprise Linux →

Enterprise Linux by Redhat

View all CVEs affecting Enterprise Linux →

Postgresql by Postgresql

View all CVEs affecting Postgresql →

Postgresql by Postgresql

View all CVEs affecting Postgresql →

Postgresql by Postgresql

View all CVEs affecting Postgresql →

Postgresql by Postgresql

View all CVEs affecting Postgresql →

Postgresql by Postgresql

View all CVEs affecting Postgresql →

Software Collections by Redhat

View all CVEs affecting Software Collections →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full database compromise leading to arbitrary code execution as bootstrap superuser, potentially allowing complete system takeover and data exfiltration.

🟠

Likely Case

Privilege escalation from database-level CREATE privilege to superuser access, enabling data manipulation, additional extension installation, or lateral movement.

🟢

If Mitigated

Limited impact if proper privilege separation exists, extensions are from trusted sources only, and CREATE privileges are restricted.

🌐 Internet-Facing: MEDIUM - Requires database-level CREATE privilege and vulnerable extension, but internet-facing databases with exposed interfaces could be targeted.
🏢 Internal Only: HIGH - Internal attackers with legitimate database access or compromised accounts can exploit this for privilege escalation.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires specific conditions: vulnerable extension must exist, attacker needs CREATE privilege, and must craft malicious SQL injection through extension variables.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Red Hat advisories for specific patched versions (RHSA-2023:7545, RHSA-2023:7579, etc.)

Vendor Advisory: https://access.redhat.com/errata/RHSA-2023:7545

Restart Required: Yes

Instructions:

1. Check PostgreSQL version. 2. Apply appropriate Red Hat security update for your PostgreSQL version. 3. Restart PostgreSQL service. 4. Verify patch installation.

🔧 Temporary Workarounds

Restrict CREATE Privilege

all

Limit database-level CREATE privilege to trusted users only to reduce attack surface.

REVOKE CREATE ON DATABASE database_name FROM username;

Audit and Remove Vulnerable Extensions

all

Identify and remove non-bundled extensions that use vulnerable variable quoting patterns.

SELECT * FROM pg_extension WHERE extname NOT IN ('plpgsql', '...bundled_extensions...');
DROP EXTENSION vulnerable_extension;

🧯 If You Can't Patch

  • Implement strict privilege management: Only grant CREATE privilege to absolutely necessary users.
  • Audit all installed extensions: Remove any non-essential extensions, especially from untrusted sources.

🔍 How to Verify

Check if Vulnerable:

Check PostgreSQL version and installed extensions. Vulnerable if: 1) Version is unpatched, 2) Non-bundled extensions exist, 3) Extension scripts use @extowner@, @extschema@, or @extschema:...@ inside quoting constructs.

Check Version:

SELECT version();

Verify Fix Applied:

Verify PostgreSQL version matches patched version from Red Hat advisories and restart service.

📡 Detection & Monitoring

Log Indicators:

  • Unusual CREATE EXTENSION attempts
  • SQL errors in extension scripts
  • Unexpected privilege escalation attempts

Network Indicators:

  • Unusual database connection patterns from users with CREATE privilege

SIEM Query:

source="postgresql.log" AND ("CREATE EXTENSION" OR "@extowner@" OR "@extschema@")

📊 Metadata

CVE ID: CVE-2023-39417
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-89
Published: August 11, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-39417, you might also want to check these:

CVE-2024-8522 10.0

This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress si...

Same vulnerability type (CWE-89)
CVE-2024-13152 10.0

This SQL injection vulnerability in BSS Software's Mobuy Online Machinery Monitoring Panel allows at...

Same vulnerability type (CWE-89)
CVE-2021-42311 10.0

CVE-2021-42311 is a critical SQL injection vulnerability in Microsoft Defender for IoT that allows r...

Same vulnerability type (CWE-89)